If you are a using OMS Log Analytics you know that the query language offers some powerful features to extract, aggregate, analyze and visualize collected data. However, there are times when some restrictions kick in and you have to find very creative workarounds to get the results you need. Sometimes it’s not possible at all. Now the good news: These days, all regions where Log Analytics is available are upgraded and your Log Analytics workspace now offers a new query language that is much more powerful and flexible.

Workspace Upgrade

First, you need to upgrade your workspace. After logging in you will discover a ribbon  saying “Log Analytics is now enhanced”. By clicking on the ribbon you get some more details about the new features.

After clicking on the button the magic happens and your workspace will be upgraded.

Now, what’s new?

A powerful query language

The big change is the new Azure Log Analytics Query Language that you might already know from “Application Insights”. It’s much more flexible and offers lots of new functions, operators and methods compared to the old query language. If you navigate to “Log search” you will immediately see the difference. You now have two query fields available, one for the old and one for the new query language. The “Convert” button not only helps you to convert your old queries into the new query language, it’s also a good option to start learning the new query language.

If you are developing your own queries, then the “Azure Log Analytics Portal” is a real game changer. By clicking on the “Advanced Analytics” link, you will be forwarded to a new portal (at least it’s new to OMS dashboard users) that allows you to develop and execute queries.

Some important features of the portal are:

• Multiple tabs to develop and execute queries
• IntelliSense
• Multi-line queries
• Quick Shift+Enter query execution
• Simple grouping and filtering of results
• In-query comments
• Multiple queries in the same file
• Save and load query files

And of course there is much more.

Quick Impressions

Multiple query tabs

Intellisense to easily develop new queries

In-query comments

Group and filter result set

Load queries and functions

Chart output

Data variation highlighting for further diagnostics

Export results

Reference

If you want to start with the Azure Log Query Language then this place is a good one to start. It gives a good kick start to the new world and offers lots of references and examples.

Rollback

What if you don’t like the new stuff or discover any issues? Then you can roll back your workspace to the old world in the workspace settings.

Expect more to come on this topic here very soon!

Cheers
Marcel